Re: [RFC PATCH v1.1 11/11] mm/damon/sysfs-schemes: kobject_del() region for populate_region error

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `kobject_del()` in the error path of `damon_sysfs_schemes_add_dirs()` leads to a directory name conflict.
--

commit 49e94fa00bb0dc5e89c773883517ea2c4db5c66b
Author: SeongJae Park <sj@kernel.org>

mm/damon/sysfs-schemes: kobject_del() region for populate_region error

On CONFIG_DEBUG_KOBJECT_RELEASE enabled kernel, lack of kobject_del()
could cause directories creation failures due to the name conflicts.
Fix the issue for tried region directories in the error handling path of
damon_sysfs_populate_region_dir() by adding a kobject_del() call.

Fixes: b574a82d10de ("mm/damon/sysfs-schemes: implement tried_regions/<r>/probes/")
Signed-off-by: SeongJae Park <sj@kernel.org>

> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index 108f6de32f8c1..084700e422cd5 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c
[ ... ]
> @@ -3135,12 +3135,14 @@ void damos_sysfs_populate_region_dir(struct damon_sysfs_schemes *sysfs_schemes,
>  				sysfs_regions->nr_regions))
>  		goto out;
>  	if (damos_sysfs_region_add_dirs(region, ctx, r))
> -		goto out;
> +		goto del_out;
>  
>  	list_add_tail(&region->list, &sysfs_regions->regions_list);
>  	sysfs_regions->nr_regions++;
>  	return;
>  
> +del_out:
> +	kobject_del(&region->kobj);
>  out:
>  	kobject_put(&region->kobj);
>  }

[Severity: High]
This isn't a bug introduced by this patch, but does the exact same problem
exist in damon_sysfs_schemes_add_dirs() when damon_sysfs_scheme_add_dirs()
fails?

mm/damon/sysfs-schemes.c:damon_sysfs_schemes_add_dirs():

	for (i = 0; i < nr_schemes; i++) {
		...
		err = kobject_init_and_add(&scheme->kobj,
				&damon_sysfs_scheme_ktype, &schemes->kobj,
				"%d", i);
		if (err)
			goto out;
		err = damon_sysfs_scheme_add_dirs(scheme);
		if (err)
			goto out;

		schemes_arr[i] = scheme;
		schemes->nr++;
	}
	return 0;

out:
	damon_sysfs_schemes_rm_dirs(schemes);
	kobject_put(&scheme->kobj);
	return err;

If damon_sysfs_scheme_add_dirs() fails, the code jumps to the out: label
and skips calling kobject_del(&scheme->kobj) for the scheme that successfully
ran kobject_init_and_add().

Under CONFIG_DEBUG_KOBJECT_RELEASE, this delayed kobject_release() could lead
to a directory name conflict (e.g. "0") if userspace retries writing to
nr_schemes immediately.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260617144807.91441-1-sj@kernel.org?part=11